Function enable 

pub fn enable(
    key: &[u8; 32],
    security_type: &str,
    biometric_wrap: Option<&str>,
    nip55_canary: Option<&str>,
    progress: &dyn Fn(MigrationProgress),
) -> Result<(), String>

Enable encryption inside a single SQLite transaction.

All mutations (event encryption, seed/pkey/PIVX encryption, flag updates) are wrapped in one transaction on the write connection. If anything fails or the app crashes before COMMIT, the database stays fully plaintext. This prevents the mixed plaintext/ciphertext state (audit C3/C4).

Memory-efficient: collects only event IDs upfront, processes one at a time.